Progress MarkLogic Server EUVD-2026-97519

Exploitation requires the attacker to already hold delegated database-administrator privileges within MarkLogic Server and to invoke backup or restore operations against forests outside their authorized database scope; affected versions are 12.x before 12.1.0 and 11.x before 11.3.7. The key limiting factor is the delegated DB-admin privilege prerequisite (CVSS PR:L) - this is not exploitable by anonymous or low-privilege users - making the realistic threat a malicious or compromised privileged tenant administrator rather than an external unauthenticated attacker. No user interaction is required (UI:N), and the operation uses legitimate backup/restore functionality rather than a non-default configuration.

This is a genuine high-priority issue for organizations running affected MarkLogic Server versions, though it is an authenticated privilege-abuse flaw rather than a wormable pre-auth bug. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 9.6) is elevated primarily by the scope change (S:C) - a delegated database administrator can reach forests and security-critical data outside their authorized database boundary, breaking the tenant/role isolation model (CWE-269). The PR:L requirement meaningfully constrains the attacker population to users who already hold delegated DB-admin rights, so this is more an insider/compromised-privileged-account risk than an anonymous internet threat. No EPSS score, KEV listing, or public POC is present in the provided data: exploitation status is 'no public exploit identified at time of analysis,' which lowers near-term mass-exploitation likelihood relative to the headline score. Note a signal tension: the input Tags label this 'Authentication Bypass,' but the description and CWE-269 describe privilege/scope escalation by an already-authenticated principal - treat the 'Authentication Bypass' tag as suspect and verify against the Progress bulletin.

A user granted delegated database-administrator rights for one tenant database (or a compromised account holding such rights) issues backup or restore operations targeting forests belonging to other databases they should not control. By restoring or reading those out-of-scope forests, they gain unauthorized access to or tamper with security-critical data such as the security database. No public exploit code is identified at time of analysis, and the attack requires valid delegated DB-admin privileges (PR:L).